This Privacy Notice aims to demonstrate that MK Secretarial has all the relevant processes and procedures in place to deal with those wishing to exercise their rights, and to assure patients that information held in all formats, is processed and shared, where appropriate, fairly, lawfully and securely.

The Data Protection Act 2018 states those who record and process personal information must be open about how the information is used, and must ensure personal data are:

• Processed lawfully, fairly and in a transparent manner
• Collected for specific, lawful and legitimate purposes
• Adequate, relevant and limited to what is necessary for the purpose
• Accurate and up to date
• Kept for no longer than necessary
• Protected and processed securely

When we are using more sensitive types of personal information, including health information, our legal basis is usually that the use is necessary:

• For the provision of health or social care or treatment or the management of health or social care systems and services; or
• In order to protect the vital interests of an individual; or
• For the establishment, exercise or defence of legal claims or in the case of a court order

UK and European law determines how organisations can use personal information. The key legislation and guidance governing the use of information is listed below:

• Data Protection Act 2018
• The Human Rights Act 1998
• Freedom of Information Act 2002
• Computer Misuse Act 1998
• Access to Health Records Act 1990
• The Human Rights Act 1998
• Common law Duty of Confidentiality
• NHS Codes of Practice (if being treated as an NHS patient)

Depending on the situation, where necessary we will share appropriate, relevant and proportionate personal information in compliance with the law, with the following:

• The patients of consultants to whom we provide services and their chosen representatives or carers
• Third parties who provide supporting services to MK Secretarial
• Hospitals, if your treatment takes place or is planned to take place there
• GP Practices
• Other medical consultants who form part of patient care
• Legal representatives acting on your behalf

There will be occasions when information will be shared without consent, particularly to protect vulnerable adults and children, to prevent serious crime or to protect public health.

Where consent is required and the subject lacks the capacity to consent, a legal representative, power of attorney, parent/guardian may consent on their behalf. Your clinician/care provider will discuss with you the reasons for this.

There are specific and clearly defined circumstances where we are required by law to share information which can identify you.

MK Secretarial does not sell personal details to any external or third party organisations.

MK Secretarial is committed to taking all reasonable measures to ensure the confidentiality and security of sensitive personal data for which we are responsible, whether computerised or on paper. All patients have the right to be informed if they have been involved in a personal data breach.

If you would like to receive a copy of all or part of your medical record held by the consultant doctor to whom MK Secretarial provide services, you have the right to request this under a Subject Access Request. There will usually be no charge for receiving copies of your medical information held by MK Secretarial, but there may be a charge for additional copies or if you have received it previously. If preferred, an electronic copy can be requested. Your right is to the data relating to you and you only, and not necessarily the record itself which can, where appropriate, be redacted if third parties are named.

You have a statutory right of access to any health record whether manual (paper) or computerised (a different form must be used for access to a deceased persons' notes) - see below. You can authorise someone else to make the application on your behalf and if you have parental responsibilities you may make an application to see your child's notes. In certain circumstances your records or part of your records may be withheld. If this is the case the reason will be provided to you.

If you are not satisfied with the response you receive you may refer your complaint to an independent arbiter such as the Information Commissioner.

Maintaining the confidentiality and security of personal information is of utmost importance to MK Secretarial. No copies of information will be sent using external mail unless this has been agreed with you, and in these circumstances Recorded Delivery will be used. When collecting information two forms of identification will be required which are detailed within the form.

You can download a Subject Access Request form by clicking here.

If at any time you feel information held by MK Secretarial relating to you is incorrect, please notify us and it will be investigated. Rectification requests on non factual information, or opinions, are unlikely to be successful but will be assessed on a case by case basis.

You may exercise your right to object to data being processed if you believe data about you is being collected, processed or shared unlawfully, and whilst this is investigated, it may be restricted until a decision is made. You have the right to withdraw your consent to data processing and usage at any time. On investigation, it is the responsibility of MK Secretarial to justify why we are continuing to process the data or if the objection will be upheld.

Where MK Secretarial acts as a data processor (we collect and process your information on behalf of someone else, for example your Consultant doctor), as opposed to acting as a data controller (we collect and process your information for our use only), the data controller will review your request and advise us what changes to make.  We will make is clear in who has made what decision and why in our response.

The right to erasure is also known as "the right to be forgotten" and in general refers to an individual's right to request the deletion or removal of personal information where there is no compelling reason for MK Secretarial to continue using it.

As with other rights, there are particular conditions around this right and it does not provide individuals with an absolute right to be forgotten.

Individuals have the right to have their personal information deleted or removed in the following circumstances:

• When it is no longer necessary for the purpose for which it was collected. When MK Secretarial no longer has a legal basis for using your personal information, for example if you gave us consent to use your personal information in a specific way and you withdraw your consent, we would need to stop using your information and erase it unless we had an overriding reason to continue to use it.
• When you object to MK Secretarial using your personal information and there is no overriding legitimate interest for us to continue using it.
• If we have used your personal information unlawfully.
• If there is a legal obligation to erase your personal information, for example by court order

MK Secretarial can refuse to deal with your request for erasure when we use your personal information for the following reasons:

• There is a legal requirement to retain your information
• The exercise or defence of legal claims

When using personal information our legal basis is usually that its use is necessary to provide healthcare services to you. This means that in most circumstances we can refuse requests for erasure. However we will advise you of this as soon as possible following receipt of your request.

Please direct any such request or concern to:

Email: [email protected]

MK Secretarial retains records in-line with NHS UK codes of practice. Below is a subset of the codes of practice containing the most common types of record we hold:

Record Type	Minimum Record Retention Period
Adult Health Record	8 years after date of discharge or when the patient was last seen
Children and Young People's Records	Retain until the patient's 25th birthday or 26th if young person was 17 at conclusion of treatment
Legal Claims	Until a case is settled or dropped
The full NHS Codes of Practice for handling information in health and care can be found here - digital.nhs.uk/codes-of-practice-handling-information

It is MK Secretarial's aim that that you receive the best possible service from us, and have a positive experience. However, if you have been unhappy with any aspects of the service provided to you, you can raise any issues with us.

If you wish to formally complain, please contact:

Mrs Michelle Knill

Email: [email protected]

You can also direct any complaints to the Information Commissioners Office by contacting:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

Website: ico.org.uk/concerns